Internal auditis thethird line of defense, providingindependent assuranceregarding risk management, controls, and governance effectiveness.

According to CRISC and the Three Lines Model:

“Internal audit independently reviews risk management processes and provides feedback on the achievement of objectives.”

Risk management (second line) monitors, not audits. Senior leadership (first line) executes strategy. Thus,Bis correct.

CRISC Reference:Domain 1 – IT Risk Governance, Topic: Three Lines Model Roles.